.Loading..Loading.
Readme Rev
Service Updates
When the downloaded patch is run, it will extract to a folder and there will be zip files. Those files should be extracted and then Setup.exe can be run. This table outlines the names of the zip files and where they should be run.
Component | Core/Console | Client |
---|
Installation Instructions
The following outlines instructions for installing this update.
This patch requires that Ivanti Endpoint Manager 2018.3 be installed. For more information about current service packs please see Ivanti Community Doc 1001
Installing on the Core and Rollup Core
Because ADS may block files on Windows systems, it is recommended that you extract the patch on the machine you are going to install it on.
Prior to installing a patch on the Core Server it is recommended to make a backup of the Ivanti database.
Steps
- Disable any services on other machines that interact with the Core Server
- Double-click on the self-extracting executable and extract it
- Extract the files for the Core patch
- From the extracted files, run Setup.exe
- When Setup completes, reboot the machine if a reboot is required
- After applying the patch, you may need to re-activate your Core Server using the Core Server Activation Utility
- Restart any services stopped in Step 1
Note: The installer included with this release writes a detailed log that can be used to help troubleshoot installation problems. After running setup.exe from the patch, the log is located in the \ManagementSuite\log folder.
Installing on Remote Consoles
A Remote Console is any machine that is not the Core Server and has the Ivanti Endpoint Manager Console installed. Console Machines need to be updated to be able to connect to the updated Core Server and Database.
Because ADS may block files on Windows systems, it is recommended that you extract the patch on the machine you are going to install it on.
Steps
- Close the Console
- Double-click on the self-extracting executable and extract it
- Extract the files for the appropriate patch
- From the extracted files, run Setup.exe
- When Setup completes, reboot the machine if a reboot is required
Note: The installer included with this release writes a detailed log that can be used to help troubleshoot installation problems. After running setup.exe from the patch, the log is located in the \ManagementSuite\log folder.
Updating the Agent
The patch should be installed on the Core Server before updating Agents
Use one of the following methods to re-deploy the agent once the patch has been applied to the Core or to apply the patch manually.
Methods of agent deployment
- Manual: Map a drive to \\Coreserver\ldlogon and run 'wscfg32.exe -f'
This is used for single client installs and testing - Push: Schedule a push of the full agent
- Self-Contained EXE: Create an EXE that can be installed
- Advance Agent: This is a two stage process. The Advance Agent consists of a small MSI and a self-contained EXE. The MSI is deploy to the client and then the MSI downloads and installs the EXE. This allows for bandwidth friendly downloads.
For more information on agent configuration and deployment see Ivanti Community Doc 23482
Manual installation of the client patch
Because ADS may block files on Windows systems, it is recommended that you extract the patch on the machine you are going to install it on.
- Double-click on the self-extracting executable and extract it
- Extract the files for the appropriate patch
- From the extracted files, run Setup.exe
- When Setup completes, reboot the machine if a reboot is required.
Updating the Agent With Patch Manager
Ivanti Patch Manager can also be used to update agent machines with the patch. Content and definitions can be found in Patch Manager as Ivanti Updates and can be used to detect and repair agents that have not been updated. The Core Server must be updated with the Core patch before updating agents.
Not all Component Patches will have Patch Manager Content created. Once it is generally available, this method can be used to update agents. For more information about updating agents using Ivanti Patch Manager see Ivanti Community Doc 24384
Release Information
Please review the following important information about this release BEFORE installing this update.
Feature Changes and Updates
The following features have been changed or updated
No new features have been added in this updateDefects Fixed
Agent
- 468601 Multicast should use point to point udp messages for sending out client public key
- Because of situations where the multicast service could send out lots of packets on the multicast channel, we modified the code to not reply to cert requests on the multicast channel but reply using point to point udp. Also, modified so that messages that were being seen a lot in network traces would be limited to one message per time period.
- 473782 Agent install issue on machines with existing agent with certain conditions
- Modified the patch install script to stop multicast service and kill selfelectcontroller before installing cba. This was necessary because selfelectcontroller accesses the service control manager quite a bit and caused the service uninstall calls to fail in cba8inst to fail.
- 493709 LANDesk Targeted Multicsast Service may crash
- There was a timing problem in one of the classes that was spinning up threads in its constructor that accesses itself.
Agent Settings
- 465692 "Remind me in" option on reboot prompt may not work
- A timing issue which caused the next prompt time to be incorrectly overwritten was fixed.
Antivirus
- 497482 Office 2010 SP2 x86 installation causes Antivirus Inventory information not to be shown
- On computers with MS Office 2010 installed, some antivirus may not be listed in the inventory information.
Appmon
- 481815 Added more details about the reason EPM reports a patch as causing an application failure
- -
- 493643 SQLite exceptions "attempt to write a readonly database"
- If the Ivanti Application Monitoring database is set to read-only for any reason, the appmon service will not work properly and will log error messages.
- 493674 Broken Applications report does not associate Chrome Patches to reported chrome issues.
- -
Console
- 351506 Distribution and Patch settings are grayed out, when accessed through the Agent Configuration
- Distribution and Patch settings are no longer greyed out when accessed through the Agent Configuration dialog.
- 435376 Remote console sizing issues on Windows 10 with multiple monitors
- Added additional handling for the Windows Snap feature. The console used to crash when minimized with Snap.
CSA
- 172340 Client Access Certs in Provisioning status not accepted via CSA
- The broker service was modified to accept provisional certificates (the kind provisioning uses) as well as the regular approved certificates.
Data Analytics
- 436597 Normalization Rule(s) Fail at 400+ Machines
- Changed the database query to process large amounts of machines the same way as smaller amounts.
- 477387 B2B Connector - Dell Warranty problems
- The API key we were using expired. We needed to get a new key and use it instead.
Endpoint Security
- 492845 EPS Blue Screen when running Driver Verifier and sending email
- When running Driver Verifier, a bug check may be triggered while executing a program that send emails using the SMTP protocol.
- 492865 An "attempt to modify system startup was detected" alert continues to show after configured to not be alerted
Inventory
- 443391 Information the inventory scanner gathered from the properties of certain modules included the square brackets.
- Corrected how the ldappl3.ini file parsed that information.
- 452328 Inventory > LDAP Groups > Machine > "Display Name" field is not collected correctly
- Fix to get the full display name, not just the first character.
- 462011 The agent sees "Microsoft Windows 10 Pro for Workstation" as "Microsoft Windows 10, 64-bit"
- Correctly detect "Microsoft Windows 10 Pro for Workstation"
- 473022 Computer Location field in inventory is showing up as full LDAP name, not OU location
- If the short form of the location does not exist in the last request results we send the FQDN form instead. We now don't send Computer Location unless we have the short form. That field is persistent in the DB so we will maintain the last short name sent.
- 484739 Miniscans to errorscan without logging
- Added exception handling to the new miniscan processing thread.
- 485584 Inventory service may crash when scan file has an element where the primary key contains " ="
- Improved parsing of primary keys in scan processing
- 500086 Inventory shows wrong OS version for Windows Server 2019
- Now detects Windows Server 2019
Mac
- 441708 "End user must grant permission" on Mac HTML Remote Control does not work.
- -
- 466825 Mac Agent Deployment fails due to Data Analytics OS name normalization
- Normalized OS names caused the core to attempt to deploy a legacy mac agent which fails to install.
- 504230 macOS Device using integrated management cannot resolve configuration profiles through the core server
- If a device was mdm and agent managed, and had multiple active network interfaces, alternating mobile syncs and agent inventory scans could toggle back and forth the primary MAC address for the device in inventory. This behavior was present in 2018.3 and later. If a provisioning template was scheduled for this device, obtaining a provisional client certificate could fail if the MAC address used in the client certificate request did not match the MAC address for the device in the scheduled provisioning template. This would cause the client certificate request to fail, and the device would then be unable to validate itself to the core, which is required by the agent to resolve configuration profiles. This has been fixed.
- 508838 Remote Control - Sometimes, permission dialog appears only after viewer has already aborted due to timeout
- Sporadically, when starting a remote control session to a macOS computer with the option to have the user grant the remote control session, the dialog asking the user to confirm the session would be displayed with a delay, causing the remote control viewer to deny the session before the user confirmation was even shown on the remote machine.
- 512949 Ivanti MDM install using VPP may fail with some newer apps.
- Several Microsoft and other newer applications failed to install via EPM's MDM management via VPP. Package should be deleted and rebuilt after SU2 install to resolve issue. TheMicrosoft Apps fixed includes: Word, Excel, PowerPoint, Remote Desktop 10
Mobility
- 463050 iOS VPP apps not updating properly
- EPM now only requests install of app on the device if it is not up-to-date. Note - apps may fail to update or install if the device OS version is too old to be supported by the app.
- 467876 MDM Help from Autopilot page links incorrectly to iOS profile signing page
- Help button on MDM Autopilot screen now goes to correct Autopilot help page.
- 467877 MDM Help missing on Agent configuration for MDM enrollment screen
- Help button added and goes to appropriate help topic for MDM enrollment with agent.
- 476189 Unable to release VPP licenses for reallocation
- This fix allows us to reclaim the license for VPP tokens that had applications assigned to users via some other method whereas before this fix we could not.
- 480861 Mobility Security Policy may be applied to MacOS inadvertently
- A placeholder profile was being pushed down to all devices, iOS, tvOS and macOS as a means to help EPM sync profiles. On the Mac, sending this profile down was causing problems with securing the lock screen of the device.
- 486184 iOS properties screen missing search bar when distributing VPP package
- VPP apps for iOS show as 'iOS' now instead of showing as 'OSX' apps in the VPP Distribution UI
- 508167 Missing resource error dialog after configuring MDM and clicking OK
- The warning that if MDM profile signing is not configured will now appear correctly with all text present. Previously the dialog appeared but did not offer any intelligible information to the user.
- 509510 VPP apps for iOS show as OSX apps on VPP Distribution UI
- VPP apps for iOS show as iOS now instead of showing as OSX apps on VPP Distribution UI
Patch Manager
- 431727 Scheduled Download, Patch and Definitions settings UI displays incorrectly
- The Scheduled Update Information window displayed the selected group to be "Unassigned" in the "Patch and definition settings" panel. Now the selected group should be displayed according to the selected option.
- 470347 Patch definition update changed exisitng definition settings
- Patch definitions with multiple rules targeting the same filename were having their scan status reset when downloading content updates. The process was fixed so that the scan status is now preserved.
- 479719 Dark Core patch download attempt results in "Signature Not Valid" Errors
- The download was failing because of some certificate validation errors that are now fixed in 2018.3.2 build.
Provisioning
- 174819 Adding Change Agent setting in Provisioning template leaves template unable to close and save
- Fixed a hard-coded English string lookup that prevented the Change Agent Setting task from saving in non-English languages.
- 472214 Copy & Paste option missing from Conditions in provisioning templates.
- Fixed an issue that was causing right click on conditions to not work. This prevented copying or pasting conditions or pasting actions into conditions.
Remote Control
- 486072 WS remote control - Mouse pointer is inaccurate with multiple monitors and/or high resolution.
- Fixed virtual spacing of multiple monitors and higher resolution monitors that casued the pointer to reflect the icorrect position on the screen.
- 492446 Remote Control WS often shows only gray screen or "Video not available"
- Fixed an issue that would cause the remote control service not to be able to access the local user's screen space. This would cause a grey screen to show up on the viewer.
- 503206 Stopping the Landesk Remote Control Service (ISSuser.exe) can cause high CPU utilization
- Fixed issue when stopping the Remote Control Service will occusionaly cause issuer.exe to consume all available cpu cycles until the device is rebooted
- 506994 RCKVM.exe processes count grows indefinitely in some circumstances
- Fix an issue where rckvm processes used in remote control could become orphaned and continue to run until reboot.
Software Distribution
- 232949 ldapwhoami.exe triggers smartcard reader dialog box
- Use LDAP, instead of LDAPS, when smart card service is running.
- 233248 Teams do not display correctly in software distribution
- Team/tenant handling was missing verification code and was causing team/tenants to not show up properly in the package manager.
- 349929 Timeout when changing task settings
- Saving a task with thousands of static targets now succeeds and no longer causes a time-out error.
- 464783 MSI Transform not work for not using msiexec.exe
- Made transform work for MSI packages that use the EPM-provided library to install (not msiexec.exe).
- 467044 MSI Transform button exists on non-MSI Windows package properties
- Hide the Transform button when non-MSI packages are chosen.
- 467101 MSI Transform button should be disabled when an MSI package path is not selected
- For MSI package type the 'Generate transform' button only enabled when MSI package is selected in 'Package information' page.
- 468384 Source only distribution task should not check preferrred servers
- Download agent setting will only from the source, not try preferred server.
- 472221 Some files may install on core when creating MST Transform
- Fixed the problem when generating a transform, it would trigger installing the actual package for certain kind MSI package.
- 479685 Task status remains in an active state indefinitely
- If status failed to send to the core due to network problem and cached for later send, only cache the most current one.
- 489030 MST transform overwrites previously created mst files
- Make sure the MST file name is unique in name dialog when initially show.
- 489439 If PolicySync /enforce runs at reboot it may interfere with sdclient continue tasks.
- PolicySync now checks to see if there is a reconnect in the actions.ini. If there is, PolicySync /enforce will exit.
- 489595 Non-EPM Admins cannot perform any EPM agent functions using the Diagnostics tool.
- Needed to add the DiagnosticsEdit right method decoration in LDApi.
Known Issues
No Known Issues